Hackers are abusing link-wrapping services to add links to phishing pages in what appear to be official emails.